CVE-2026-49229: Actual Budget insufficient session expiration for disabled OpenID users

CVE-2026-49229 · Severity: high · CVSS 8.3 · Published 2026-07-07

Actual, a personal finance and budgeting application, contained a flaw where users who were disabled by an administrator could still access their accounts. While the system blocked new logins for disabled accounts, it failed to invalidate existing active sessions. This means a deactivated user—including a former administrator—could continue to view sensitive financial data or modify budgets indefinitely if they had an active session token.

Technologies: Actual Budget, Actual Budget Sync Server, @actual-app/sync-server (npm). Vendors: Actual Budget, npm.

Quick answers

Is CVE-2026-49229 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49229 being exploited in the wild.
How severe is CVE-2026-49229?
High severity, with a CVSS score of 8.3, published 7 July 2026.
Which products and versions are affected?
Actual Budget < 26.6.0; Actual Budget Sync Server <= 26.5.2; @actual-app/sync-server (npm) <= 26.5.2, SEMVER:introduced=0,fixed=26.6.0.
Is there a fix for CVE-2026-49229?
Yes. @actual-app/sync-server (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49229 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49229?
Check whether you run Actual Budget, Actual Budget Sync Server or @actual-app/sync-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @actual-app/sync-server (npm): upgrade to 26.6.0 or later
    npm install @actual-app/sync-server@26.6.0

Technical details

A session management vulnerability exists in Actual Budget's sync-server prior to version 26.6.0. While the OpenID login flow correctly checks the 'enabled' status of a user, the 'validateSession' middleware only verified that a session token existed and had not expired. Because the default 'token_expiration' is set to 'never', disabled users could retain access indefinitely. An attacker with a pre-existing session token can continue to call authenticated endpoints, including sync operations and administrative functions if they previously held an admin role. The fix in 26.6.0 ensures the session validation path joins with the users table to verify the account is still enabled and revokes existing sessions upon user deactivation.

Affected products

  • actualbudget Actual Budget < 26.6.0

Identifiers

  • CVE-2026-49229
  • GHSA-cq9c-6w48-qmfg

Timeline

  • 2026-06-01: patched: Version 26.6.0 released
  • 2026-06-12: advisory: GitHub Security Advisory published
  • 2026-07-07: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.